csrutil

usage: csrutil <command>
Modify the System Integrity Protection configuration. All configuration changes apply to the entire machine.
Available commands:
clear
Clear the existing configuration. Only available in Recovery OS.
disable
Disable the protection on the machine. Only available in Recovery OS.
enable
Enable the protection on the machine. Only available in Recovery OS.
status
Display the current configuration.
netboot
add <address>
Insert a new IPv4 address in the list of allowed NetBoot sources.
list
Print the list of allowed NetBoot sources.
remove <address>
Remove an IPv4 address from the list of allowed NetBoot sources.

查看狀態執行csutil status：

System Integrity Protection status: enabled (Custom Configuration).

單單關閉SIP執行sudo csrutil enable --no-internal：

Successfully enabled System Integrity Protection. Please restart the machine for the changes to take effect.

如果你出現：

csrutil: failed to modify system integrity configuration. This tool needs to be executed from the Recovery OS.

代表你使用的並非Recovery OS開機，請確定從Recovery OS開機再執行。

csrutil 進階指令

如果你只是要細部的關閉某個SIP功能例如關閉kext需要簽章功能執行sudo csrutil enable --without kext：

csrutil: requesting an unsupported configuration. This is likely to break in the future and leave your machine in an unknown state.
Successfully enabled System Integrity Protection. Please restart the machine for the changes to take effect.